Snort_AIPreproc/corr_rules/1-1924-8.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE hyperalert PUBLIC "-//blacklight//DTD HYPERALERT SNORT MODEL//EN" "http://0x00.ath.cx/hyperalert.dtd">

<hyperalert>
	<snort-id>1.1924.8</snort-id>
	<desc>RPC mountd UDP export request</desc>

	<pre>HostExists(+DST_ADDR+)</pre>
	<pre>HasService(+DST_ADDR+, +DST_PORT+)</pre>
	<pre>HasRemoteAccess(+SRC_ADDR+, +DST_ADDR+)</pre>
	
	<post>HasNfsAccess(+SRC_ADDR+, +DST_ADDR+)</post>
</hyperalert>